]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c
projects / proxmark3-svn / blob
? search:


cf36b95a034c17490746241c515b8540d5239f9e
[proxmark3-svn] / armsrc / mifarecmd.c
1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 // Midnitesnake - Dec 2013
6 // Andy Davies - Apr 2014
7 // Iceman - May 2014
8 //
9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
10 // at your option, any later version. See the LICENSE.txt file for the text of
11 // the license.
12 //-----------------------------------------------------------------------------
13 // Routines to support ISO 14443 type A.
14 //-----------------------------------------------------------------------------
15
16 #include "mifarecmd.h"
17 #include "apps.h"
18 #include "util.h"
19
20 #include "des.h"
21 #include "crc.h"
22
23 // the block number for the ISO14443-4 PCB
24 uint8_t pcb_blocknum = 0;
25 // Deselect card by sending a s-block. the crc is precalced for speed
26 static uint8_t deselect_cmd[] = {0xc2,0xe0,0xb4};
27
28
29 //-----------------------------------------------------------------------------
30 // Select, Authenticate, Read a MIFARE tag.
31 // read block
32 //-----------------------------------------------------------------------------
33 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
34 {
35 // params
36 uint8_t blockNo = arg0;
37 uint8_t keyType = arg1;
38 uint64_t ui64Key = 0;
39 ui64Key = bytes_to_num(datain, 6);
40
41 // variables
42 byte_t isOK = 0;
43 byte_t dataoutbuf[16];
44 uint8_t uid[10];
45 uint32_t cuid;
46 struct Crypto1State mpcs = {0, 0};
47 struct Crypto1State *pcs;
48 pcs = &mpcs;
49
50 // clear trace
51 clear_trace();
52 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
53
54 LED_A_ON();
55 LED_B_OFF();
56 LED_C_OFF();
57
58 while (true) {
59 if(!iso14443a_select_card(uid, NULL, &cuid)) {
60 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
61 break;
62 };
63
64 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
65 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
66 break;
67 };
68
69 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
70 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");
71 break;
72 };
73
74 if(mifare_classic_halt(pcs, cuid)) {
75 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
76 break;
77 };
78
79 isOK = 1;
80 break;
81 }
82
83 // ----------------------------- crypto1 destroy
84 crypto1_destroy(pcs);
85
86 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
87
88 LED_B_ON();
89 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
90 LED_B_OFF();
91
92 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
93 LEDsoff();
94 }
95
96 void MifareUC_Auth1(uint8_t arg0, uint8_t *datain){
97
98 byte_t dataoutbuf[16] = {0x00};
99 uint8_t uid[10] = {0x00};
100 uint32_t cuid = 0x00;
101
102 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
103
104 clear_trace();
105 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
106
107 if(!iso14443a_select_card(uid, NULL, &cuid)) {
108 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
109 OnError(0);
110 return;
111 };
112
113 if(mifare_ultra_auth1(dataoutbuf)){
114 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
115 OnError(1);
116 return;
117 }
118
119 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
120
121 cmd_send(CMD_ACK,1,cuid,0,dataoutbuf,11);
122 LEDsoff();
123 }
124 void MifareUC_Auth2(uint8_t arg0, uint8_t *datain){
125
126 uint8_t key[16] = {0x00};
127 byte_t dataoutbuf[16] = {0x00};
128
129 memcpy(key, datain, 16);
130
131 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
132
133 if(mifare_ultra_auth2(key, dataoutbuf)){
134 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part2: Fail...");
135 OnError(1);
136 return;
137 }
138
139 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
140
141 cmd_send(CMD_ACK,1,0,0,dataoutbuf,11);
142 if (arg0) {
143 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
144 LEDsoff();
145 }
146 }
147
148 // Arg0 = BlockNo,
149 // Arg1 = UsePwd bool
150 // datain = PWD bytes,
151 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
152 {
153 uint8_t blockNo = arg0;
154 byte_t dataout[16] = {0x00};
155 uint8_t uid[10] = {0x00};
156 uint8_t key[16] = {0x00};
157 bool usePwd = (arg1 == 1);
158
159 LEDsoff();
160 LED_A_ON();
161 clear_trace();
162 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
163
164 int len = iso14443a_select_card(uid, NULL, NULL);
165 if(!len) {
166 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
167 OnError(1);
168 return;
169 }
170
171 // authenticate here.
172 if ( usePwd ) {
173
174 memcpy(key, datain, 16);
175
176 // Dbprintf("KEY: %02x %02x %02x %02x %02x %02x %02x %02x", key[0],key[1],key[2],key[3],key[4],key[5],key[6],key[7] );
177 // Dbprintf("KEY: %02x %02x %02x %02x %02x %02x %02x %02x", key[8],key[9],key[10],key[11],key[12],key[13],key[14],key[15] );
178
179 uint8_t random_a[8] = {1,1,1,1,1,1,1,1 };
180 uint8_t random_b[8] = {0x00};
181 uint8_t enc_random_b[8] = {0x00};
182 uint8_t rnd_ab[16] = {0x00};
183 uint8_t IV[8] = {0x00};
184
185 uint16_t len;
186 uint8_t receivedAnswer[MAX_FRAME_SIZE];
187 uint8_t receivedAnswerPar[MAX_PARITY_SIZE];
188
189 len = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);
190 if (len != 11) {
191 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
192 OnError(1);
193 return;
194 }
195
196 // tag nonce.
197 memcpy(enc_random_b,receivedAnswer+1,8);
198
199 // decrypt nonce.
200 tdes_2key_dec(random_b, enc_random_b, sizeof(random_b), key, IV );
201 rol(random_b,8);
202 memcpy(rnd_ab ,random_a,8);
203 memcpy(rnd_ab+8,random_b,8);
204
205 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
206 Dbprintf("enc_B: %02x %02x %02x %02x %02x %02x %02x %02x",
207 enc_random_b[0],enc_random_b[1],enc_random_b[2],enc_random_b[3],
208 enc_random_b[4],enc_random_b[5],enc_random_b[6],enc_random_b[7]);
209
210 Dbprintf(" B: %02x %02x %02x %02x %02x %02x %02x %02x",
211 random_b[0],random_b[1],random_b[2],random_b[3],
212 random_b[4],random_b[5],random_b[6],random_b[7]);
213
214 Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",
215 rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],
216 rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);
217
218 Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",
219 rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],
220 rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15] );
221 }
222
223 // encrypt out, in, length, key, iv
224 tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);
225
226 len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, rnd_ab, receivedAnswer, receivedAnswerPar, NULL);
227 if (len != 11) {
228 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
229 OnError(1);
230 return;
231 }
232
233 uint8_t enc_resp[8] = { 0 };
234 uint8_t resp_random_a[8] = { 0 };
235 memcpy(enc_resp, receivedAnswer+1, 8);
236
237 // decrypt out, in, length, key, iv
238 tdes_2key_dec(resp_random_a, enc_resp, 8, key, enc_random_b);
239 if ( memcmp(resp_random_a, random_a, 8) != 0 )
240 Dbprintf("failed authentication");
241
242 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
243 Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x",
244 rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],
245 rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);
246
247 Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x",
248 rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],
249 rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15]);
250
251 Dbprintf("a: %02x %02x %02x %02x %02x %02x %02x %02x",
252 random_a[0],random_a[1],random_a[2],random_a[3],
253 random_a[4],random_a[5],random_a[6],random_a[7]);
254
255 Dbprintf("b: %02x %02x %02x %02x %02x %02x %02x %02x",
256 resp_random_a[0],resp_random_a[1],resp_random_a[2],resp_random_a[3],
257 resp_random_a[4],resp_random_a[5],resp_random_a[6],resp_random_a[7]);
258 }
259 }
260
261 if( mifare_ultra_readblock(blockNo, dataout) ) {
262 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
263 OnError(2);
264 return;
265 }
266
267 if( mifare_ultra_halt() ) {
268 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
269 OnError(3);
270 return;
271 }
272
273 cmd_send(CMD_ACK,1,0,0,dataout,16);
274 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
275 LEDsoff();
276 }
277
278 //-----------------------------------------------------------------------------
279 // Select, Authenticate, Read a MIFARE tag.
280 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
281 //-----------------------------------------------------------------------------
282 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
283 {
284 // params
285 uint8_t sectorNo = arg0;
286 uint8_t keyType = arg1;
287 uint64_t ui64Key = 0;
288 ui64Key = bytes_to_num(datain, 6);
289
290 // variables
291 byte_t isOK = 0;
292 byte_t dataoutbuf[16 * 16];
293 uint8_t uid[10];
294 uint32_t cuid;
295 struct Crypto1State mpcs = {0, 0};
296 struct Crypto1State *pcs;
297 pcs = &mpcs;
298
299 // clear trace
300 clear_trace();
301
302 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
303
304 LED_A_ON();
305 LED_B_OFF();
306 LED_C_OFF();
307
308 isOK = 1;
309 if(!iso14443a_select_card(uid, NULL, &cuid)) {
310 isOK = 0;
311 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
312 }
313
314
315 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
316 isOK = 0;
317 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
318 }
319
320 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
321 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
322 isOK = 0;
323 if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
324 break;
325 }
326 }
327
328 if(mifare_classic_halt(pcs, cuid)) {
329 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
330 }
331
332 // ----------------------------- crypto1 destroy
333 crypto1_destroy(pcs);
334
335 if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
336
337 LED_B_ON();
338 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
339 LED_B_OFF();
340
341 // Thats it...
342 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
343 LEDsoff();
344 }
345
346 void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
347 {
348 // params
349 uint8_t blockNo = arg0;
350 uint16_t blocks = arg1;
351 bool useKey = (arg2 == 1); //UL_C
352 bool usePwd = (arg2 == 2); //UL_EV1/NTAG
353 int countblocks = 0;
354 uint8_t dataout[176] = {0x00};
355
356 LEDsoff();
357 LED_A_ON();
358 clear_trace();
359 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
360
361 int len = iso14443a_select_card(NULL, NULL, NULL);
362 if (!len) {
363 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);
364 OnError(1);
365 return;
366 }
367
368 // authenticate
369 if ( useKey ) {
370 uint8_t key[16] = {0x00};
371 memcpy(key, datain, 16);
372
373 uint8_t random_a[8] = {1,1,1,1,1,1,1,1 };
374 uint8_t random_b[8] = {0x00};
375 uint8_t enc_random_b[8] = {0x00};
376 uint8_t rnd_ab[16] = {0x00};
377 uint8_t IV[8] = {0x00};
378
379 uint16_t len2;
380 uint8_t receivedAnswer[MAX_FRAME_SIZE];
381 uint8_t receivedAnswerPar[MAX_PARITY_SIZE];
382
383 len2 = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);
384 if (len2 != 11) {
385 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
386 OnError(1);
387 return;
388 }
389
390 // tag nonce.
391 memcpy(enc_random_b,receivedAnswer+1,8);
392
393 // decrypt nonce.
394 tdes_2key_dec(random_b, enc_random_b, sizeof(random_b), key, IV );
395 rol(random_b,8);
396 memcpy(rnd_ab ,random_a,8);
397 memcpy(rnd_ab+8,random_b,8);
398
399 // encrypt out, in, length, key, iv
400 tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);
401
402 len2 = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, rnd_ab, receivedAnswer, receivedAnswerPar, NULL);
403 if (len2 != 11) {
404 OnError(1);
405 return;
406 }
407
408 uint8_t enc_resp[8] = { 0 };
409 uint8_t resp_random_a[8] = { 0 };
410 memcpy(enc_resp, receivedAnswer+1, 8);
411
412 // decrypt out, in, length, key, iv
413 tdes_2key_dec(resp_random_a, enc_resp, 8, key, enc_random_b);
414 if ( memcmp(resp_random_a, random_a, 8) != 0 )
415 Dbprintf("failed authentication");
416 }
417
418 if (usePwd) { //ev1 or ntag auth
419 uint8_t Pwd[4] = {0x00};
420 memcpy(Pwd, datain, 4);
421 uint8_t pack[4] = {0,0,0,0};
422
423 if (mifare_ul_ev1_auth(Pwd, pack)){
424 OnError(1);
425 Dbprintf("failed authentication");
426 return;
427 }
428 }
429
430 for (int i = 0; i < blocks; i++){
431 len = mifare_ultra_readblock(blockNo * 4 + i, dataout + 4 * i);
432
433 if (len) {
434 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);
435 OnError(2);
436 return;
437 } else {
438 countblocks++;
439 }
440 }
441
442 len = mifare_ultra_halt();
443 if (len) {
444 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
445 OnError(3);
446 return;
447 }
448
449 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Blocks read %d", countblocks);
450
451 len = blocks * 4;
452
453 cmd_send(CMD_ACK, 1, len, 0, dataout, len);
454 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
455 LEDsoff();
456 }
457
458 //-----------------------------------------------------------------------------
459 // Select, Authenticate, Write a MIFARE tag.
460 // read block
461 //-----------------------------------------------------------------------------
462 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
463 {
464 // params
465 uint8_t blockNo = arg0;
466 uint8_t keyType = arg1;
467 uint64_t ui64Key = 0;
468 byte_t blockdata[16];
469
470 ui64Key = bytes_to_num(datain, 6);
471 memcpy(blockdata, datain + 10, 16);
472
473 // variables
474 byte_t isOK = 0;
475 uint8_t uid[10];
476 uint32_t cuid;
477 struct Crypto1State mpcs = {0, 0};
478 struct Crypto1State *pcs;
479 pcs = &mpcs;
480
481 // clear trace
482 clear_trace();
483
484 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
485
486 LED_A_ON();
487 LED_B_OFF();
488 LED_C_OFF();
489
490 while (true) {
491 if(!iso14443a_select_card(uid, NULL, &cuid)) {
492 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
493 break;
494 };
495
496 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
497 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
498 break;
499 };
500
501 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
502 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
503 break;
504 };
505
506 if(mifare_classic_halt(pcs, cuid)) {
507 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
508 break;
509 };
510
511 isOK = 1;
512 break;
513 }
514
515 // ----------------------------- crypto1 destroy
516 crypto1_destroy(pcs);
517
518 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
519
520 LED_B_ON();
521 cmd_send(CMD_ACK,isOK,0,0,0,0);
522 LED_B_OFF();
523
524
525 // Thats it...
526 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
527 LEDsoff();
528 }
529
530 void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
531 {
532 uint8_t blockNo = arg0;
533 byte_t blockdata[16] = {0x00};
534
535 memcpy(blockdata, datain, 16);
536
537 uint8_t uid[10] = {0x00};
538
539 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
540
541 clear_trace();
542 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
543
544 if(!iso14443a_select_card(uid, NULL, NULL)) {
545 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
546 OnError(0);
547 return;
548 };
549
550 if(mifare_ultra_writeblock(blockNo, blockdata)) {
551 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
552 OnError(0);
553 return; };
554
555 if(mifare_ultra_halt()) {
556 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
557 OnError(0);
558 return;
559 };
560
561 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
562
563 cmd_send(CMD_ACK,1,0,0,0,0);
564 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
565 LEDsoff();
566 }
567
568 void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
569 {
570 uint8_t blockNo = arg0;
571 byte_t blockdata[4] = {0x00};
572
573 memcpy(blockdata, datain,4);
574
575 uint8_t uid[10] = {0x00};
576
577 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
578 clear_trace();
579 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
580
581 if(!iso14443a_select_card(uid, NULL, NULL)) {
582 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
583 OnError(0);
584 return;
585 };
586
587 if(mifare_ultra_special_writeblock(blockNo, blockdata)) {
588 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
589 OnError(0);
590 return;
591 };
592
593 if(mifare_ultra_halt()) {
594 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
595 OnError(0);
596 return;
597 };
598
599 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
600
601 cmd_send(CMD_ACK,1,0,0,0,0);
602 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
603 LEDsoff();
604 }
605
606 void MifareUSetPwd(uint8_t arg0, uint8_t *datain){
607
608 uint8_t pwd[16] = {0x00};
609 byte_t blockdata[4] = {0x00};
610
611 memcpy(pwd, datain, 16);
612
613 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
614 clear_trace();
615 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
616
617 if(!iso14443a_select_card(NULL, NULL, NULL)) {
618 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
619 OnError(0);
620 return;
621 };
622
623 blockdata[0] = pwd[7];
624 blockdata[1] = pwd[6];
625 blockdata[2] = pwd[5];
626 blockdata[3] = pwd[4];
627 if(mifare_ultra_special_writeblock( 44, blockdata)) {
628 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
629 OnError(44);
630 return;
631 };
632
633 blockdata[0] = pwd[3];
634 blockdata[1] = pwd[2];
635 blockdata[2] = pwd[1];
636 blockdata[3] = pwd[0];
637 if(mifare_ultra_special_writeblock( 45, blockdata)) {
638 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
639 OnError(45);
640 return;
641 };
642
643 blockdata[0] = pwd[15];
644 blockdata[1] = pwd[14];
645 blockdata[2] = pwd[13];
646 blockdata[3] = pwd[12];
647 if(mifare_ultra_special_writeblock( 46, blockdata)) {
648 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
649 OnError(46);
650 return;
651 };
652
653 blockdata[0] = pwd[11];
654 blockdata[1] = pwd[10];
655 blockdata[2] = pwd[9];
656 blockdata[3] = pwd[8];
657 if(mifare_ultra_special_writeblock( 47, blockdata)) {
658 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
659 OnError(47);
660 return;
661 };
662
663 if(mifare_ultra_halt()) {
664 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
665 OnError(0);
666 return;
667 };
668
669 cmd_send(CMD_ACK,1,0,0,0,0);
670 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
671 LEDsoff();
672 }
673
674 // Return 1 if the nonce is invalid else return 0
675 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
676 return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
677 (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
678 (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
679 }
680
681
682 //-----------------------------------------------------------------------------
683 // MIFARE nested authentication.
684 //
685 //-----------------------------------------------------------------------------
686 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
687 {
688 // params
689 uint8_t blockNo = arg0 & 0xff;
690 uint8_t keyType = (arg0 >> 8) & 0xff;
691 uint8_t targetBlockNo = arg1 & 0xff;
692 uint8_t targetKeyType = (arg1 >> 8) & 0xff;
693 uint64_t ui64Key = 0;
694
695 ui64Key = bytes_to_num(datain, 6);
696
697 // variables
698 uint16_t rtr, i, j, len;
699 uint16_t davg;
700 static uint16_t dmin, dmax;
701 uint8_t uid[10];
702 uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
703 uint8_t par[1];
704 uint32_t target_nt[2], target_ks[2];
705
706 uint8_t par_array[4];
707 uint16_t ncount = 0;
708 struct Crypto1State mpcs = {0, 0};
709 struct Crypto1State *pcs;
710 pcs = &mpcs;
711 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
712
713 uint32_t auth1_time, auth2_time;
714 static uint16_t delta_time;
715
716 // free eventually allocated BigBuf memory
717 BigBuf_free();
718 // clear trace
719 clear_trace();
720 set_tracing(false);
721
722 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
723
724 LED_A_ON();
725 LED_C_OFF();
726
727
728 // statistics on nonce distance
729 if (calibrate) { // for first call only. Otherwise reuse previous calibration
730 LED_B_ON();
731 WDT_HIT();
732
733 davg = dmax = 0;
734 dmin = 2000;
735 delta_time = 0;
736
737 for (rtr = 0; rtr < 17; rtr++) {
738
739 // prepare next select. No need to power down the card.
740 if(mifare_classic_halt(pcs, cuid)) {
741 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
742 rtr--;
743 continue;
744 }
745
746 if(!iso14443a_select_card(uid, NULL, &cuid)) {
747 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
748 rtr--;
749 continue;
750 };
751
752 auth1_time = 0;
753 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
754 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
755 rtr--;
756 continue;
757 };
758
759 if (delta_time) {
760 auth2_time = auth1_time + delta_time;
761 } else {
762 auth2_time = 0;
763 }
764 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
765 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");
766 rtr--;
767 continue;
768 };
769
770 nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
771 for (i = 101; i < 1200; i++) {
772 nttmp = prng_successor(nttmp, 1);
773 if (nttmp == nt2) break;
774 }
775
776 if (i != 1200) {
777 if (rtr != 0) {
778 davg += i;
779 dmin = MIN(dmin, i);
780 dmax = MAX(dmax, i);
781 }
782 else {
783 delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing
784 }
785 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
786 }
787 }
788
789 if (rtr <= 1) return;
790
791 davg = (davg + (rtr - 1)/2) / (rtr - 1);
792
793 if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time);
794
795 dmin = davg - 2;
796 dmax = davg + 2;
797
798 LED_B_OFF();
799
800 }
801 // -------------------------------------------------------------------------------------------------
802
803 LED_C_ON();
804
805 // get crypted nonces for target sector
806 for(i=0; i < 2; i++) { // look for exactly two different nonces
807
808 target_nt[i] = 0;
809 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
810
811 // prepare next select. No need to power down the card.
812 if(mifare_classic_halt(pcs, cuid)) {
813 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
814 continue;
815 }
816
817 if(!iso14443a_select_card(uid, NULL, &cuid)) {
818 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
819 continue;
820 };
821
822 auth1_time = 0;
823 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
824 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
825 continue;
826 };
827
828 // nested authentication
829 auth2_time = auth1_time + delta_time;
830 len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
831 if (len != 4) {
832 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);
833 continue;
834 };
835
836 nt2 = bytes_to_num(receivedAnswer, 4);
837 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
838
839 // Parity validity check
840 for (j = 0; j < 4; j++) {
841 par_array[j] = (oddparity(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
842 }
843
844 ncount = 0;
845 nttest = prng_successor(nt1, dmin - 1);
846 for (j = dmin; j < dmax + 1; j++) {
847 nttest = prng_successor(nttest, 1);
848 ks1 = nt2 ^ nttest;
849
850 if (valid_nonce(nttest, nt2, ks1, par_array)){
851 if (ncount > 0) { // we are only interested in disambiguous nonces, try again
852 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
853 target_nt[i] = 0;
854 break;
855 }
856 target_nt[i] = nttest;
857 target_ks[i] = ks1;
858 ncount++;
859 if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
860 target_nt[i] = 0;
861 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
862 break;
863 }
864 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
865 }
866 }
867 if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
868 }
869 }
870
871 LED_C_OFF();
872
873 // ----------------------------- crypto1 destroy
874 crypto1_destroy(pcs);
875
876 byte_t buf[4 + 4 * 4];
877 memcpy(buf, &cuid, 4);
878 memcpy(buf+4, &target_nt[0], 4);
879 memcpy(buf+8, &target_ks[0], 4);
880 memcpy(buf+12, &target_nt[1], 4);
881 memcpy(buf+16, &target_ks[1], 4);
882
883 LED_B_ON();
884 cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
885 LED_B_OFF();
886
887 if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");
888
889 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
890 LEDsoff();
891 set_tracing(TRUE);
892 }
893
894 //-----------------------------------------------------------------------------
895 // MIFARE check keys. key count up to 85.
896 //
897 //-----------------------------------------------------------------------------
898 void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
899 {
900 // params
901 uint8_t blockNo = arg0;
902 uint8_t keyType = arg1;
903 uint8_t keyCount = arg2;
904 uint64_t ui64Key = 0;
905
906 // variables
907 int i;
908 byte_t isOK = 0;
909 uint8_t uid[10];
910 uint32_t cuid;
911 struct Crypto1State mpcs = {0, 0};
912 struct Crypto1State *pcs;
913 pcs = &mpcs;
914
915 // clear debug level
916 int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
917 MF_DBGLEVEL = MF_DBG_NONE;
918
919 // clear trace
920 clear_trace();
921 set_tracing(TRUE);
922
923 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
924
925 LED_A_ON();
926 LED_B_OFF();
927 LED_C_OFF();
928
929 for (i = 0; i < keyCount; i++) {
930 if(mifare_classic_halt(pcs, cuid)) {
931 if (MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Halt error");
932 }
933
934 if(!iso14443a_select_card(uid, NULL, &cuid)) {
935 if (OLD_MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Can't select card");
936 break;
937 };
938
939 ui64Key = bytes_to_num(datain + i * 6, 6);
940 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
941 continue;
942 };
943
944 isOK = 1;
945 break;
946 }
947
948 // ----------------------------- crypto1 destroy
949 crypto1_destroy(pcs);
950
951 LED_B_ON();
952 cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);
953 LED_B_OFF();
954
955 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
956 LEDsoff();
957
958 // restore debug level
959 MF_DBGLEVEL = OLD_MF_DBGLEVEL;
960 }
961
962 //-----------------------------------------------------------------------------
963 // MIFARE commands set debug level
964 //
965 //-----------------------------------------------------------------------------
966 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
967 MF_DBGLEVEL = arg0;
968 Dbprintf("Debug level: %d", MF_DBGLEVEL);
969 }
970
971 //-----------------------------------------------------------------------------
972 // Work with emulator memory
973 //
974 //-----------------------------------------------------------------------------
975 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
976 emlClearMem();
977 }
978
979 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
980 emlSetMem(datain, arg0, arg1); // data, block num, blocks count
981 }
982
983 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
984 byte_t buf[USB_CMD_DATA_SIZE];
985 emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
986
987 LED_B_ON();
988 cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
989 LED_B_OFF();
990 }
991
992 //-----------------------------------------------------------------------------
993 // Load a card into the emulator memory
994 //
995 //-----------------------------------------------------------------------------
996 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
997 uint8_t numSectors = arg0;
998 uint8_t keyType = arg1;
999 uint64_t ui64Key = 0;
1000 uint32_t cuid;
1001 struct Crypto1State mpcs = {0, 0};
1002 struct Crypto1State *pcs;
1003 pcs = &mpcs;
1004
1005 // variables
1006 byte_t dataoutbuf[16];
1007 byte_t dataoutbuf2[16];
1008 uint8_t uid[10];
1009
1010 // clear trace
1011 clear_trace();
1012 set_tracing(false);
1013
1014 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1015
1016 LED_A_ON();
1017 LED_B_OFF();
1018 LED_C_OFF();
1019
1020 bool isOK = true;
1021
1022 if(!iso14443a_select_card(uid, NULL, &cuid)) {
1023 isOK = false;
1024 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1025 }
1026
1027 for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
1028 ui64Key = emlGetKey(sectorNo, keyType);
1029 if (sectorNo == 0){
1030 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
1031 isOK = false;
1032 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);
1033 break;
1034 }
1035 } else {
1036 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
1037 isOK = false;
1038 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
1039 break;
1040 }
1041 }
1042
1043 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
1044 if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
1045 isOK = false;
1046 if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
1047 break;
1048 };
1049 if (isOK) {
1050 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
1051 emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
1052 } else { // sector trailer, keep the keys, set only the AC
1053 emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
1054 memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
1055 emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
1056 }
1057 }
1058 }
1059
1060 }
1061
1062 if(mifare_classic_halt(pcs, cuid)) {
1063 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1064 };
1065
1066 // ----------------------------- crypto1 destroy
1067 crypto1_destroy(pcs);
1068
1069 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1070 LEDsoff();
1071
1072 if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
1073
1074 }
1075
1076
1077 //-----------------------------------------------------------------------------
1078 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
1079 //
1080 //-----------------------------------------------------------------------------
1081 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1082
1083 // params
1084 uint8_t needWipe = arg0;
1085 // bit 0 - need get UID
1086 // bit 1 - need wupC
1087 // bit 2 - need HALT after sequence
1088 // bit 3 - need init FPGA and field before sequence
1089 // bit 4 - need reset FPGA and LED
1090 uint8_t workFlags = arg1;
1091 uint8_t blockNo = arg2;
1092
1093 // card commands
1094 uint8_t wupC1[] = { 0x40 };
1095 uint8_t wupC2[] = { 0x43 };
1096 uint8_t wipeC[] = { 0x41 };
1097
1098 // variables
1099 byte_t isOK = 0;
1100 uint8_t uid[10] = {0x00};
1101 uint8_t d_block[18] = {0x00};
1102 uint32_t cuid;
1103
1104 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1105 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1106
1107 // reset FPGA and LED
1108 if (workFlags & 0x08) {
1109 LED_A_ON();
1110 LED_B_OFF();
1111 LED_C_OFF();
1112
1113 clear_trace();
1114 set_tracing(TRUE);
1115 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1116 }
1117
1118 while (true) {
1119
1120 // get UID from chip
1121 if (workFlags & 0x01) {
1122 if(!iso14443a_select_card(uid, NULL, &cuid)) {
1123 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1124 break;
1125 };
1126
1127 if(mifare_classic_halt(NULL, cuid)) {
1128 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1129 break;
1130 };
1131 };
1132
1133 // reset chip
1134 if (needWipe){
1135 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1136 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1137 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1138 break;
1139 };
1140
1141 ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1142 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1143 if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");
1144 break;
1145 };
1146
1147 if(mifare_classic_halt(NULL, cuid)) {
1148 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1149 break;
1150 };
1151 };
1152
1153 // write block
1154 if (workFlags & 0x02) {
1155 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1156 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1157 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1158 break;
1159 };
1160
1161 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1162 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1163 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1164 break;
1165 };
1166 }
1167
1168 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
1169 if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");
1170 break;
1171 };
1172
1173 memcpy(d_block, datain, 16);
1174 AppendCrc14443a(d_block, 16);
1175
1176 ReaderTransmit(d_block, sizeof(d_block), NULL);
1177 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
1178 if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");
1179 break;
1180 };
1181
1182 if (workFlags & 0x04) {
1183 if (mifare_classic_halt(NULL, cuid)) {
1184 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1185 break;
1186 };
1187 }
1188
1189 isOK = 1;
1190 break;
1191 }
1192
1193 LED_B_ON();
1194 cmd_send(CMD_ACK,isOK,0,0,uid,4);
1195 LED_B_OFF();
1196
1197 if ((workFlags & 0x10) || (!isOK)) {
1198 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1199 LEDsoff();
1200 }
1201 }
1202
1203
1204 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1205
1206 // params
1207 // bit 1 - need wupC
1208 // bit 2 - need HALT after sequence
1209 // bit 3 - need init FPGA and field before sequence
1210 // bit 4 - need reset FPGA and LED
1211 uint8_t workFlags = arg0;
1212 uint8_t blockNo = arg2;
1213
1214 // card commands
1215 uint8_t wupC1[] = { 0x40 };
1216 uint8_t wupC2[] = { 0x43 };
1217
1218 // variables
1219 byte_t isOK = 0;
1220 uint8_t data[18] = {0x00};
1221 uint32_t cuid = 0;
1222
1223 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1224 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1225
1226 if (workFlags & 0x08) {
1227 LED_A_ON();
1228 LED_B_OFF();
1229 LED_C_OFF();
1230
1231 clear_trace();
1232 set_tracing(TRUE);
1233 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1234 }
1235
1236 while (true) {
1237 if (workFlags & 0x02) {
1238 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1239 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1240 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1241 break;
1242 };
1243
1244 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1245 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1246 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1247 break;
1248 };
1249 }
1250
1251 // read block
1252 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1253 if (MF_DBGLEVEL >= 1) Dbprintf("read block send command error");
1254 break;
1255 };
1256 memcpy(data, receivedAnswer, 18);
1257
1258 if (workFlags & 0x04) {
1259 if (mifare_classic_halt(NULL, cuid)) {
1260 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1261 break;
1262 };
1263 }
1264
1265 isOK = 1;
1266 break;
1267 }
1268
1269 LED_B_ON();
1270 cmd_send(CMD_ACK,isOK,0,0,data,18);
1271 LED_B_OFF();
1272
1273 if ((workFlags & 0x10) || (!isOK)) {
1274 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1275 LEDsoff();
1276 }
1277 }
1278
1279 void MifareCIdent(){
1280
1281 // card commands
1282 uint8_t wupC1[] = { 0x40 };
1283 uint8_t wupC2[] = { 0x43 };
1284
1285 // variables
1286 byte_t isOK = 1;
1287
1288 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1289 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1290
1291 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1292 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1293 isOK = 0;
1294 };
1295
1296 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1297 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1298 isOK = 0;
1299 };
1300
1301 if (mifare_classic_halt(NULL, 0)) {
1302 isOK = 0;
1303 };
1304
1305 cmd_send(CMD_ACK,isOK,0,0,0,0);
1306 }
1307
1308 //
1309 // DESFIRE
1310 //
1311
1312 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1313
1314 byte_t dataout[11] = {0x00};
1315 uint8_t uid[10] = {0x00};
1316 uint32_t cuid;
1317
1318 clear_trace();
1319 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1320
1321 int len = iso14443a_select_card(uid, NULL, &cuid);
1322 if(!len) {
1323 if (MF_DBGLEVEL >= MF_DBG_ERROR)
1324 Dbprintf("Can't select card");
1325 //OnError(1);
1326 return;
1327 };
1328
1329 if(mifare_desfire_des_auth1(cuid, dataout)){
1330 if (MF_DBGLEVEL >= MF_DBG_ERROR)
1331 Dbprintf("Authentication part1: Fail.");
1332 //OnError(4);
1333 return;
1334 }
1335
1336 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1337
1338 cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));
1339 }
1340
1341 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1342
1343 uint32_t cuid = arg0;
1344 uint8_t key[16] = {0x00};
1345 byte_t isOK = 0;
1346 byte_t dataout[12] = {0x00};
1347
1348 memcpy(key, datain, 16);
1349
1350 isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1351
1352 if( isOK) {
1353 if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
1354 Dbprintf("Authentication part2: Failed");
1355 //OnError(4);
1356 return;
1357 }
1358
1359 if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
1360 DbpString("AUTH 2 FINISHED");
1361
1362 cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1363 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1364 LEDsoff();
1365 }
1366
1367 void OnSuccess(){
1368 pcb_blocknum = 0;
1369 ReaderTransmit(deselect_cmd, 3 , NULL);
1370 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1371 LEDsoff();
1372 }
1373
1374 void OnError(uint8_t reason){
1375 pcb_blocknum = 0;
1376 ReaderTransmit(deselect_cmd, 3 , NULL);
1377 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1378 cmd_send(CMD_ACK,0,reason,0,0,0);
1379 LEDsoff();
1380 }
Proxmark3 GIT tracking
Impressum, Datenschutz